Octofs
MCPB · OCTOFS-0.22.1-X86_64-UNKNOWN-LINUX-MUSL.MCPB · 7 COMPONENTS
Standalone MCP filesystem tools server — view, edit, shell, workdir.
Available components
Last scanned (6 hours ago)
Scores higher than 81% of MCPB servers
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability61
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2009 tokens (~334/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.97 → pass security
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 −1
- Stability: pass → 0.93 functional
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed mcpb/https://github.com/Muvon/octofs/releases/download/0.22.1/octofs-0.22.1-x86_64-unknown-linux-musl.mcpb
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | mcpb |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
batch_edit Batch Edit ~208
Apply insert/replace operations (max 50) to one file atomically. Targets are line ids ("12:a3") from view or edit output, verified before anything is written; a stale id fails with the current content. All targets refer to the original file and must not overlap. Put every edit you already know for a file into one call: separate edit calls to the same file, even parallel ones, invalidate each other's ids. The result diff carries fresh ids for follow-up edits — no re-view needed; removed lines, and the middle of a long added block, show as an id range, and a trailing `shift:` line says how later original line numbers moved. Insert anchors 0 (file start) and -1 (end) are plain integers. Content is raw text without id prefixes.
| Name | Type | Req | Description |
|---|---|---|---|
| operations | array | yes | Operations on this one file (max 50). |
| path | string | yes | File to edit (ssh://user@host:port/path for remote). |
No output schema declared.
No examples provided.
extract_lines Extract Lines ~180
Copy a line range from one file and append it into another without retyping it — moving code between files, splitting modules. The source is left untouched; to move, follow with a batch_edit that removes the range.
| Name | Type | Req | Description |
|---|---|---|---|
| append_line | – | yes | Where to append in the target: a line id to insert after (verified against the target), or 0 = beginning, -1 = end. |
| append_path | string | yes | Target file the lines are appended to (ssh://user@host:port/path for remote). |
| from_end | – | – | Last line to copy (inclusive): integer or line id. Default: `from_start`. |
| from_path | string | yes | Source file (ssh://user@host:port/path for remote). |
| from_start | – | yes | First line to copy (inclusive): integer or line id (verified against the source). |
No output schema declared.
No examples provided.
shell Shell ~525
Run a shell command: builds, tests, git, project CLIs. `sh -c` (`cmd /C` on Windows) in the current workdir, local machine only, no stdin or TTY — never run interactive commands or prefix `cd <workdir> &&` (`cd <other> && …` is fine one-off; `workdir` switches permanently; a remote ssh:// workdir disables shell). Use `view` to read, list and search files (cat/head/tail/grep/rg/find/ls except as a later pipe stage, `sed -i` and standalone `tee` anywhere, and echo/printf/cat redirects into the workdir are rejected). Local writes outside it (`cd /tmp/x && printf … > f`) run with a hint; `printf … | prog` is no write. Output is terminal-clean (ANSI and progress redraws stripped, repeated lines collapsed with a count; pipe through `od -c` or `xxd` for exact bytes); a non-zero exit returns as an error with the output. Large recognized test/build output is digested with its full output path appended. Verify narrow first: start with the smallest check that exercises your change — one test, target, package or sample input, in the mode it targets — then broaden only as far as the change can reach; a change everything depends on (a shared header, a build flag) ends with the full run. Repeat a full run only after a change that could alter its result. A command still running after ~10s moves to the background and returns a job resource showing a progress tail while running; on exit you receive the exit code and the same output as a foreground command. Its result then arrives on its own as a message. Do not poll it (`ps`, `tail`, sleep, viewing the linked resource, any other status check), re-run it or start a variant of it (other flags or filters). While it runs, keep working on anything that does not need its result (read or review related code, write or update tests, prepare the next edit); only when nothing like that is left, reply with a brief status and no tool call to wait. Resume dependent work when its completion notification arrives. Unrelated commands run concurrently…
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | Command line for `sh -c`; use non-interactive flags (`-y`, `--no-pager`, `CI=1`) for anything that might prompt. |
No output schema declared.
No examples provided.
text_editor Text Editor ~214
File operations. create: new file only — fails if it exists, parent directories are made. str_replace: raw file text (real newlines, no `N:hh|` prefixes); old_text must match exactly once, or set replace_all: true — on multiple matches the error lists their line ids, on none the closest matches, for batch_edit. delete: remove a file (not a directory). undo_edit: revert the last edit to `path` (10 levels, delete included). Prefer batch_edit when you already hold line ids.
| Name | Type | Req | Description |
|---|---|---|---|
| command | – | yes | Operation to perform. |
| content | string | – | Content for `create`. |
| new_text | string | – | `str_replace`: replacement text (required). |
| old_text | string | – | `str_replace`: exact text to find (required). |
| path | string | yes | File path (ssh://user@host:port/path for remote). |
| replace_all | boolean | – | `str_replace`: replace every occurrence (rename-style). Default: false. |
No output schema declared.
No examples provided.
view View ~630
Read files, list directories, search content. Lines render as `N:hh|content`; copy `N:hh` verbatim — it is the line id edit tools target. Listings are recursive and gitignore-aware, one `path NL ~Nt` (lines, ~tokens) per file. An image file (png, jpg, gif, webp by extension) comes back as the image itself; `start`/`end` and `content` do not apply to it. Re-viewing a whole file may return only the hunks changed since your last view (or an unchanged marker); ranged reads always return the requested lines. Reuse returned content: read a complete block in one call, combine adjacent windows, never re-read overlapping ranges or narrow one just to pick edit targets; re-read only when the file may have changed or output was truncated.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | Locate code: searches the whole file/tree (`start`/`end` ignored) for a literal substring, or a Rust regex with `regex: true` (`(?i)` case-insensitive; alternation for related terms). |
| context | integer | – | Lines around each `content` match. Default: 0. |
| end | – | – | Last line (inclusive): line id or integer (negative counts from the end). Default: end of file; omit both `start` and `end` for the whole file. |
| full | boolean | – | Force the complete file when re-viewing a whole file (normally only changed hunks), e.g. after losing earlier context. No effect on ranges or searches; output limits unchanged. |
| include_hidden | boolean | – | Include dotfiles and dot-directories. |
| max_depth | integer | – | Directory depth bound. Default: unlimited, except a bare remote listing (no `pattern`/`content`) stops at the root entries. Searches walk the whole tree. |
| path | string | yes | File or directory. `a|b` searches several roots with `content` (max 32); several files take parallel view calls. Remote: ssh://[user@]host[:port]/path (host may be an ~/.ssh/config alias; `ssh://host… |
| pattern | string | – | Ripgrep -g globs bounding listings and searches: without `/` a name at any depth, with `/` the relative path; `*`, `**`, `?`, `[abc]`, `{rs,toml}`, leading `!`; `|` joins ordered globs (later wins),… |
| regex | boolean | – | Treat `content` as a regex. Default: false. |
| start | – | – | First line (inclusive): line id or integer (negative counts from the end, -1 = last). Default: line 1. |
No output schema declared.
No examples provided.
workdir Working Directory ~155
Switch the working directory for later calls (`path`) or revert to the session root (`reset: true`). Every tool resolves relative paths against it; do not call it just to check the directory. A remote (ssh://) workdir disables `shell`.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | – | Directory to switch into, absolute or relative to the current workdir; omit it (without `reset`) to get the current workdir back, rarely needed since it is already known. Not `"."` (a no-op). Remote:… |
| reset | boolean | – | Revert to the session root. |
No output schema declared.
No examples provided.
How do I install the Octofs MCP server?
Octofs ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, 1afac0592ab07551d3ed2c5cd2b6f7dfffd9de83bf23518c28ad65fb47ce9a14; the commands to do that are on this page. If it does not match, do not open it.
mcpb · octofs-0.22.1-x86_64-unknown-linux-musl.mcpb
Download bundleCheck the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.
SHA-256
1afac0592ab07551d3ed2c5cd2b6f7dfffd9de83bf23518c28ad65fb47ce9a14
macOS / Linux
echo "1afac0592ab07551d3ed2c5cd2b6f7dfffd9de83bf23518c28ad65fb47ce9a14 octofs-0.22.1-x86_64-unknown-linux-musl.mcpb" | shasum -a 256 -c
Windows (PowerShell)
(Get-FileHash -Algorithm SHA256 .\octofs-0.22.1-x86_64-unknown-linux-musl.mcpb).Hash -eq "1afac0592ab07551d3ed2c5cd2b6f7dfffd9de83bf23518c28ad65fb47ce9a14"
Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.
What is the Octofs MCP server?
Octofs is an MCP server listed in the public MCP registry as io.github.Muvon/octofs. Standalone MCP filesystem tools server, view, edit, shell, workdir. This page covers its MCPB bundle (https://github.com/Muvon/octofs/releases/download/0.22.1/octofs-0.22.1-x86_64-unknown-linux-musl.mcpb).
Is the Octofs MCP server safe to use?
Octofs scores 50 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Octofs MCP server expose?
Octofs exposes 6 tools: batch_edit, extract_lines, shell, text_editor, view, workdir. Their descriptions and schemas cost roughly 1,912 tokens of context every time the server is loaded.